This bug is known, and was fixed by upstream maintainers in cvs head and deerpark branch, see https://bugzilla.mozilla.org/show_bug.cgi?id=293307 for details.
Here is a backported patch for this bug:
diff -urN a/modules/libpr0n/src/imgLoader.cpp b/modules/libpr0n/src/imgLoader.cpp --- a/modules/libpr0n/src/imgLoader.cpp 2004-08-14 01:39:57.000000000 +0400 +++ b/modules/libpr0n/src/imgLoader.cpp 2005-06-19 15:12:41.000000000 +0400 @@ -896,7 +896,7 @@ // the network. aProxy->AddToLoadGroup(); - mProxies.AppendElement(aProxy); + mProxies.AppendObject(aProxy); } /** nsIRequestObserver methods **/ @@ -909,13 +909,10 @@ PRBool isFromCache; if (NS_SUCCEEDED(cacheChan->IsFromCache(&isFromCache)) && isFromCache) { - PRUint32 count; - mProxies.Count(&count); + PRUint32 count = mProxies.Count(); for (PRInt32 i = count-1; i>=0; i--) { - imgRequestProxy *proxy; - mProxies.GetElementAt(i, (nsISupports**)&proxy); + imgRequestProxy *proxy = NS_STATIC_CAST(imgRequestProxy *, mProxies[i]); mRequest->NotifyProxyListener(proxy); - NS_RELEASE(proxy); } mRequest->SetLoadId(mContext); @@ -964,14 +961,11 @@ mDestListener = NS_STATIC_CAST(nsIStreamListener*, pl); - PRUint32 count; - mProxies.Count(&count); + PRUint32 count = mProxies.Count(); for (PRInt32 i = count-1; i>=0; i--) { - imgRequestProxy *proxy; - mProxies.GetElementAt(i, (nsISupports**)&proxy); + imgRequestProxy *proxy = NS_STATIC_CAST(imgRequestProxy *, mProxies[i]); proxy->ChangeOwner(request); request->NotifyProxyListener(proxy); - NS_RELEASE(proxy); } NS_RELEASE(request); diff -urN a/modules/libpr0n/src/imgLoader.h b/modules/libpr0n/src/imgLoader.h --- a/modules/libpr0n/src/imgLoader.h 2004-08-14 01:39:57.000000000 +0400 +++ b/modules/libpr0n/src/imgLoader.h 2005-06-19 15:10:11.000000000 +0400 @@ -90,7 +90,7 @@ * validate checker */ -#include "nsSupportsArray.h" +#include "nsCOMArray.h" class imgCacheValidator : public nsIStreamListener { @@ -109,7 +109,7 @@ nsCOMPtr<nsIStreamListener> mDestListener; imgRequest *mRequest; - nsSupportsArray mProxies; + nsCOMArray<imgIRequest> mProxies; void *mContext; };